S. 4831 — Stop Spying Bosses Act

This section defines terms for the Act, including the Administrator of the Worker Protection and Technology Division, aggregated data that prevents individual identification, automated decision systems that produce predictions or decisions (excluding passive infrastructure), biometric information from unique biological characteristics (excluding photographs and recordings), covered individuals as employees and applicants, employers as entities with 11 or more covered individuals engaged in commerce, and employee data linked to covered individuals.

This section prohibits employers and their service providers from collecting or using employee data to identify union activity or protected concerted activity, ascertain unrelated political, religious, health, or immigration information, predict employee behavior, or threaten employee health. It bars off-duty collection in break rooms, restrooms, lactation or prayer spaces, and private homes. Collection is permitted only for listed job-related purposes if strictly necessary, minimally invasive, disclosed in advance, limited to the fewest individuals and least data required, and retained no longer than reasonably necessary or 3 years after separation. The section also bans selling employee data and restricts transfers to service providers and third parties. It takes effect 60 days after enactment.

This section requires employers to disclose to each covered individual (employees and applicants) the employee data collected on that individual, including what data are collected, how and when, storage location, access, purposes, third-party involvement, and effects on work-related decisions such as performance assessments. Employers must provide initial disclosures upon hiring or within 30 days for existing employees, before accepting applications from applicants, and updated disclosures at least 7 days before changes, all in plain language, accessible formats, and machine-readable online form, effective 60 days after enactment.

This section requires employers to enable covered individuals to obtain their employee data within 30 days of a request and to correct incomplete or erroneous data at any time. For work-related decisions, employers must disclose the categories of employee data used, provide at least 7 days for review of the data and related aggregated data for similarly situated individuals, allow corrections, and permit requests for reconsideration, effective 60 days after enactment.

This section establishes the Worker Protection and Technology Division in the Department of Labor, headed by a presidentially appointed Administrator. It authorizes the Administrator to hire technologists outside standard civil service rules at compensation up to Executive Schedule level V, establishes four advisory boards (User, Research, Product, and Labor) on employer treatment of employee data that meet at least twice annually and are exempt from the Federal Advisory Committee Act, permits use of voluntary services and attorney representation in litigation, and authorizes the Secretary, acting through the Administrator and the Wage and Hour Division Administrator, to issue orders and guidance after consulting agencies including the FTC, EEOC, NLRB, and National Mediation Board.

This section authorizes the Secretary of Labor, acting through the Administrator and in consultation with the Wage and Hour Division, FTC, EEOC, and NLRB, to prescribe regulations implementing the Act for covered individuals and affected employers. It directs the Comptroller General, Librarian of Congress, Board of Directors of the Office of Compliance, President, and Director of the Office of Personnel Management to issue matching regulations for their respective employees within 45 days after the Secretary acts, subject to good-cause modifications.

This section prohibits employers from discriminating or retaliating against covered individuals for exercising rights under the Act or for making complaints, seeking assistance on worker privacy concerns, or participating in inquiries or proceedings related to violations of sections 3, 4, or 5. It requires employers to notify all covered individuals of these protections in an accessible and plain-language manner.

This section authorizes the Secretary of Labor, through the Worker Protection and Technology Division, to investigate employers and third parties, require reports and records, and enforce violations of sections 3, 4, 5, or 8 in the same manner as Fair Labor Standards Act sections 6 and 7. It prioritizes industries with high employee data collection and surveillance-related health risks, requires referral of potential criminal violations to the Attorney General, and creates a private right of action for covered individuals and labor organizations that allows double actual damages, statutory damages of up to $500 per individual for first disclosure violations, injunctive and equitable relief, temporary whistleblower relief, and attorney's fees.

This section requires the Secretary, acting through the Administrator, to study workplace surveillance and employers' collection of employee data about covered individuals, including through technological means. It also directs annual reports to Congress, beginning one year after enactment, with findings and recommendations to reduce related harms, made publicly available.

This section requires the Secretary, acting through the Administrator, to coordinate with appropriate Federal agencies and State regulators to promote consistent regulatory treatment of employee data.

This section provides that the Act does not preempt, modify, limit, or supersede any provision of Federal or State law or the authority of the Federal Trade Commission, Equal Employment Opportunity Commission, National Labor Relations Board, or any other Federal agency, except where the Act explicitly states otherwise.

This section provides that if any provision of the Act is held unconstitutional, the remainder of the Act and its application to other persons or circumstances remain in effect.